mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
aea7b30b29
Updated CodeQL configuration to exclude additional paths for security checks. Introduced a new file access rate limiter to prevent abuse of file download endpoints. Improved path resolution functions to ensure confined access and added validation in body scalar functions to reject non-scalar types. Enhanced error handling in API endpoint validation to prevent invalid inputs.
45 lines
1.2 KiB
JavaScript
45 lines
1.2 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* Strip dangerous substrings until a full pass produces no change.
|
|
* @param {string} input
|
|
* @param {Array<(s: string) => string>} replacers
|
|
* @returns {string}
|
|
*/
|
|
function stripUntilStable(input, replacers) {
|
|
let result = String(input ?? '');
|
|
let prev;
|
|
do {
|
|
prev = result;
|
|
for (const replacer of replacers) {
|
|
result = replacer(result);
|
|
}
|
|
} while (result !== prev);
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* Remove opening/closing HTML/SVG tags for a given tag name (case-insensitive).
|
|
* @param {string} input
|
|
* @param {string} tagName
|
|
* @returns {string}
|
|
*/
|
|
function stripTagName(input, tagName) {
|
|
const name = String(tagName).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
|
|
const open = new RegExp(`<\\s*${name}\\b[^>]*>`, 'gi');
|
|
const close = new RegExp(`<\\s*/\\s*${name}\\b[^>]*>`, 'gi');
|
|
const selfClose = new RegExp(`<\\s*${name}\\b[^>]*/\\s*>`, 'gi');
|
|
let result = input;
|
|
let prev;
|
|
do {
|
|
prev = result;
|
|
result = result.replace(open, '').replace(close, '').replace(selfClose, '');
|
|
} while (result !== prev);
|
|
return result;
|
|
}
|
|
|
|
module.exports = {
|
|
stripUntilStable,
|
|
stripTagName,
|
|
};
|